CVE-2026-85916
MediumCVSS 6.2Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
Exposure of private personal information to an unauthorized actor in Azure Active Directory allows an unauthorized attacker to disclose information locally. The vulnerability involves leakage of personal data.
Risk Assessment
An unauthenticated attacker with local access could obtain private personal data, potentially leading to privacy breaches and regulatory non-compliance. The risk is limited to the local context.
Recommendation
Immediately apply updates for Azure Active Directory and review access permissions for personal data.
Other vulnerabilities in Azure Active Directory
See all- CVE-2026-69851Critical
Server-side request forgery (SSRF) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.
- CVE-2026-50481Critical
Modification of assumed-immutable data (MAID) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.
- CVE-2026-45480Critical
Improper authentication in Azure Active Directory allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-50653High
An infinite loop in Azure Active Directory allows an unauthorized attacker to deny service over a network.
- CVE-2026-50652High
In Azure Active Directory, a deserialization of untrusted data vulnerability allows an unauthorized attacker to perform a denial of service (DoS) attack over the network.
- CVE-2023-36871Medium
A vulnerability in Azure Active Directory allows for a security feature bypass, potentially leading to unauthorized access to resources.
Original NVD description (English source)
Exposure of private personal information to an unauthorized actor in Azure Active Directory allows an unauthorized attacker to disclose information locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS